Add INC-132..134 for the three CVE candidates triaged as relevant (#60, #81, #84)

README.md

@@ -82,7 +82,7 @@ Every file answers one question: **which controls from framework X address vulne
 | **70+** open-source tools | Catalogued and organised by function |
 | **25** eval profiles | Runnable Garak (13) + PyRIT (6) + LAAF (6) tests mapped to OWASP entries |
 | **<!-- stats:frameworks-mapped -->26<!-- /stats -->** compliance reports | Per-framework gap assessments auto-generated from data layer (MD, CSV, JSON, OSCAL) |
-| **<!-- stats:incidents -->131<!-- /stats -->** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) |
+| **<!-- stats:incidents -->134<!-- /stats -->** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) |
 | **LAAF v2.0** | First agentic LPCI red-teaming framework — fully integrated with 6-stage × OWASP crosswalk |
 
 All free. All open-source. Built for practitioners.

data/entries/ASI02.json

@@ -102,7 +102,14 @@
       "url": "https://atlas.mitre.org/techniques/AML.T0053",
       "notes": "Exploiting overly permissive tool access to exceed intended agent scope",
       "confidence": "unreviewed",
-      "reviewed_by": []
+      "reviewed_by": [],
+      "evidence_count": 0,
+      "evidence": {
+        "confirmed": [],
+        "drafted": [
+          "INC-132"
+        ]
+      }
     },
     {
       "framework": "MITRE ATLAS",
@@ -1248,6 +1255,12 @@
       "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
       "year": 2025,
       "incident_id": "INC-114"
+    },
+    {
+      "name": "Agno agent framework: prompt injection to remote code execution via PythonTools and ShellTools",
+      "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-132"
     }
   ],
   "crossrefs": {

data/entries/ASI03.json

@@ -830,7 +830,14 @@
       "scope": "Both",
       "notes": "Least privilege per agent role — scope enforced, reviewed quarterly",
       "confidence": "unreviewed",
-      "reviewed_by": []
+      "reviewed_by": [],
+      "evidence_count": 0,
+      "evidence": {
+        "confirmed": [],
+        "drafted": [
+          "INC-133"
+        ]
+      }
     },
     {
       "framework": "OWASP NHI Top 10",
@@ -1305,6 +1312,12 @@
       "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
       "year": 2025,
       "incident_id": "INC-114"
+    },
+    {
+      "name": "MCPHub: missing authorisation let any user overwrite the prompts and resources served to everyone",
+      "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-133"
     }
   ],
   "crossrefs": {

data/entries/ASI05.json

@@ -1162,6 +1162,12 @@
       "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
       "year": 2025,
       "incident_id": "INC-114"
+    },
+    {
+      "name": "Agno agent framework: prompt injection to remote code execution via PythonTools and ShellTools",
+      "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-132"
     }
   ],
   "crossrefs": {

data/entries/ASI06.json

@@ -1144,6 +1144,12 @@
       "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
       "year": 2025,
       "incident_id": "INC-108"
+    },
+    {
+      "name": "MCPHub: missing authorisation let any user overwrite the prompts and resources served to everyone",
+      "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-133"
     }
   ],
   "crossrefs": {

data/entries/DSGAI02.json

@@ -1039,6 +1039,12 @@
       "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
       "year": 2026,
       "incident_id": "INC-112"
+    },
+    {
+      "name": "Headroom: cross-site WebSocket hijacking gave any browser page unauthenticated use of the LLM proxy",
+      "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-134"
     }
   ],
   "crossrefs": {

data/entries/LLM01.json

@@ -969,7 +969,14 @@
       "scope": "Both",
       "notes": "Apply least-privilege to all LLM application credentials",
       "confidence": "unreviewed",
-      "reviewed_by": []
+      "reviewed_by": [],
+      "evidence_count": 0,
+      "evidence": {
+        "confirmed": [],
+        "drafted": [
+          "INC-133"
+        ]
+      }
     },
     {
       "framework": "OWASP NHI Top 10",
@@ -1413,6 +1420,18 @@
       "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
       "year": 2025,
       "incident_id": "INC-110"
+    },
+    {
+      "name": "Agno agent framework: prompt injection to remote code execution via PythonTools and ShellTools",
+      "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-132"
+    },
+    {
+      "name": "MCPHub: missing authorisation let any user overwrite the prompts and resources served to everyone",
+      "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-133"
     }
   ],
   "crossrefs": {

data/entries/LLM06.json

@@ -1028,6 +1028,12 @@
       "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
       "year": 2024,
       "incident_id": "INC-045"
+    },
+    {
+      "name": "Headroom: cross-site WebSocket hijacking gave any browser page unauthenticated use of the LLM proxy",
+      "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-134"
     }
   ],
   "crossrefs": {

data/incidents.json

@@ -1,6 +1,6 @@
 {
   "version": "3.1.0",
-  "generated": "2026-08-28",
+  "generated": "2026-09-18",
   "description": "Real-world and research-demonstrated AI security incidents, mapped to OWASP GenAI entries and MAESTRO architectural layers. Maintained as part of the OWASP GenAI Crosswalk.",
   "incidents": [
     {
@@ -8190,6 +8190,232 @@
           "confirmed_by": []
         }
       ]
+    },
+    {
+      "id": "INC-132",
+      "title": "Agno agent framework: prompt injection to remote code execution via PythonTools and ShellTools",
+      "date": "2026-08",
+      "year": 2026,
+      "category": "research-demonstrated",
+      "severity": "Critical",
+      "description": "CVE-2026-37003, published 2026-08-27, reports that Agno up to and including 2.5.8 passes unsanitised, LLM-generated arguments from its PythonTools and ShellTools components straight to execution sinks — exec(), runpy.run_path() and subprocess.run(). The CVE description states that \"an unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent (such as web pages or documents), allowing for arbitrary code and OS command execution on the host server.\" Provenance is thinner than the other two 2026 agent-framework CVEs in this corpus: the CNA is MITRE rather than the vendor, NVD lists the record as Deferred, the CVSS 9.8 is a secondary metric from a third party rather than an NVD or vendor score, and no vendor advisory or fix release has been published. The record is included because the CVE is published and its mechanism is stated; the evidence behind the score is not the vendor's.",
+      "owasp_entries": [
+        "LLM01",
+        "ASI02",
+        "ASI05"
+      ],
+      "maestro_layers": [
+        {
+          "layer": "L3",
+          "label": "Agent Frameworks",
+          "role": "origin",
+          "notes": "Tool components pass model output to execution sinks unsanitised"
+        },
+        {
+          "layer": "L4",
+          "label": "Deployment & Infrastructure",
+          "role": "impact",
+          "notes": "Code and OS commands execute on the host running the agent"
+        }
+      ],
+      "attack_vector": "Indirect prompt injection in content the agent processes, reaching exec(), runpy.run_path() and subprocess.run() through tool arguments",
+      "affected": "Agno up to and including 2.5.8",
+      "impact": "Arbitrary code and OS command execution on the host server, unauthenticated",
+      "mitigations": [
+        "Treat model-generated tool arguments as untrusted input, never as code",
+        "Run code-executing tools in a sandbox with no host filesystem or network reach",
+        "Allow-list tool operations rather than passing free-form arguments to execution sinks"
+      ],
+      "external_refs": [
+        {
+          "source": "CVE",
+          "id": "CVE-2026-37003",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37003"
+        }
+      ],
+      "references": [
+        {
+          "title": "NVD — CVE-2026-37003",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37003",
+          "type": "advisory"
+        }
+      ],
+      "tags": [
+        "cve",
+        "agentic",
+        "prompt-injection",
+        "code-execution",
+        "agno",
+        "tooling",
+        "draft-evidence"
+      ],
+      "control_failures": [
+        {
+          "framework": "MITRE ATLAS",
+          "control_id": "AML.T0053",
+          "outcome": "absent",
+          "basis": "The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run().",
+          "source_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37003",
+          "confirmed_by": []
+        }
+      ]
+    },
+    {
+      "id": "INC-133",
+      "title": "MCPHub: missing authorisation let any user overwrite the prompts and resources served to everyone",
+      "date": "2026-08",
+      "year": 2026,
+      "category": "research-demonstrated",
+      "severity": "High",
+      "description": "GHSA-6cvf-cfch-4g7m / CVE-2026-79745, published by the MCPHub maintainers on 2026-08-23 and fixed in 1.0.32, reports that \"the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes are attached to the authenticated router with no admin gate, and the handlers never read req.user.\" Because the DAO singletons those routes write are consulted first — ahead of any connected MCP server — \"a non-admin can therefore create, overwrite, and shadow global prompt templates and resources that all other users are served.\" The advisory is explicit that the scored impact is the integrity violation and that \"stored prompt injection into other users' LLM sessions is a downstream consequence of that tampering.\"",
+      "owasp_entries": [
+        "ASI03",
+        "LLM01",
+        "ASI06"
+      ],
+      "maestro_layers": [
+        {
+          "layer": "L3",
+          "label": "Agent Frameworks",
+          "role": "origin",
+          "notes": "MCP orchestration layer serves prompt templates and resources from a shared store"
+        },
+        {
+          "layer": "L6",
+          "label": "Security & Compliance",
+          "role": "propagation",
+          "notes": "Authentication was enforced; authorisation was not"
+        }
+      ],
+      "attack_vector": "Authenticated non-admin user writes global prompt templates and resources through unguarded mutating API routes",
+      "affected": "MCPHub before 1.0.32",
+      "impact": "Tampering with prompts and resources served to every other session, with stored prompt injection as the downstream effect",
+      "mitigations": [
+        "Gate mutating routes on an authorisation check, not only on authentication",
+        "Have handlers read the authenticated principal before writing shared state",
+        "Upgrade to MCPHub 1.0.32 or later"
+      ],
+      "external_refs": [
+        {
+          "source": "CVE",
+          "id": "CVE-2026-79745",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79745"
+        },
+        {
+          "source": "GHSA",
+          "id": "GHSA-6cvf-cfch-4g7m",
+          "url": "https://github.com/samanhappy/mcphub/security/advisories/GHSA-6cvf-cfch-4g7m"
+        }
+      ],
+      "references": [
+        {
+          "title": "MCPHub security advisory GHSA-6cvf-cfch-4g7m",
+          "url": "https://github.com/samanhappy/mcphub/security/advisories/GHSA-6cvf-cfch-4g7m",
+          "type": "advisory"
+        },
+        {
+          "title": "MCPHub 1.0.32 release",
+          "url": "https://github.com/samanhappy/mcphub/releases/tag/v1.0.32",
+          "type": "vendor"
+        }
+      ],
+      "tags": [
+        "cve",
+        "ghsa",
+        "mcp",
+        "authorisation",
+        "prompt-injection",
+        "mcphub",
+        "draft-evidence"
+      ],
+      "control_failures": [
+        {
+          "framework": "OWASP NHI Top 10",
+          "control_id": "NHI-5",
+          "outcome": "absent",
+          "basis": "The mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes are attached to the authenticated router with no admin gate, and the handlers never read req.user.",
+          "source_url": "https://github.com/samanhappy/mcphub/security/advisories/GHSA-6cvf-cfch-4g7m",
+          "confirmed_by": []
+        }
+      ]
+    },
+    {
+      "id": "INC-134",
+      "title": "Headroom: cross-site WebSocket hijacking gave any browser page unauthenticated use of the LLM proxy",
+      "date": "2026-08",
+      "year": 2026,
+      "category": "research-demonstrated",
+      "severity": "High",
+      "description": "GHSA-h46j-26q3-rggf / CVE-2026-71416, published by the Headroom maintainers on 2026-08-27 and fixed in 0.35.0, reports that \"the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication.\" The advisory states this \"can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the OPENAI_API_KEY environment variable.\" The handler is the WebSocket route at ws://<headroom_host>:8787/v1/responses.",
+      "owasp_entries": [
+        "DSGAI02",
+        "LLM06"
+      ],
+      "maestro_layers": [
+        {
+          "layer": "L4",
+          "label": "Deployment & Infrastructure",
+          "role": "origin",
+          "notes": "Proxy accepts WebSocket upgrades without checking the request origin"
+        },
+        {
+          "layer": "L6",
+          "label": "Security & Compliance",
+          "role": "impact",
+          "notes": "The proxy holds the upstream API credential on the caller's behalf"
+        }
+      ],
+      "attack_vector": "Cross-site WebSocket hijacking — a page in the victim's browser opens a WebSocket to the local proxy, which forwards upstream using the stored API key",
+      "affected": "Headroom before 0.35.0",
+      "impact": "Arbitrary LLM requests billed to the victim's API key, without authentication",
+      "mitigations": [
+        "Validate the Origin header before accepting a WebSocket upgrade",
+        "Require an authentication token on the proxy rather than relying on network position",
+        "Upgrade to Headroom 0.35.0 or later"
+      ],
+      "external_refs": [
+        {
+          "source": "CVE",
+          "id": "CVE-2026-71416",
+          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71416"
+        },
+        {
+          "source": "GHSA",
+          "id": "GHSA-h46j-26q3-rggf",
+          "url": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf"
+        }
+      ],
+      "references": [
+        {
+          "title": "Headroom security advisory GHSA-h46j-26q3-rggf",
+          "url": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf",
+          "type": "advisory"
+        },
+        {
+          "title": "Headroom 0.35.0 release",
+          "url": "https://github.com/headroomlabs-ai/headroom/releases/tag/v0.35.0",
+          "type": "vendor"
+        }
+      ],
+      "tags": [
+        "cve",
+        "ghsa",
+        "cswsh",
+        "websocket",
+        "credential-abuse",
+        "headroom",
+        "draft-evidence"
+      ],
+      "control_failures": [
+        {
+          "framework": "OWASP NHI Top 10",
+          "control_id": "NHI-4",
+          "outcome": "absent",
+          "basis": "The Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication.",
+          "source_url": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf",
+          "confirmed_by": []
+        }
+      ]
     }
   ]
 }